메뉴
Workload Identity is mandatory for AKS Automatic. Covers managed identity setup, federated credentials, service account annotation, and Entra ID RBAC integration.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | kickstart-workload-identity |
| description | Workload Identity is mandatory for AKS Automatic. Covers managed identity setup, federated credentials, service account annotation, and Entra ID RBAC integration. |
| disable-model-invocation | true |
AKS Automatic uses Azure Workload Identity for pod-level Azure access. AADPODIDENTITY is deprecated — do not use it.
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-sa
namespace: default
annotations:
azure.workload.identity/client-id: "<managed-identity-client-id>"
metadata:
labels:
azure.workload.identity/use: "true"
spec:
serviceAccountName: my-app-sa
The Azure SDK picks up the token automatically via the OIDC projected volume.
AKS Automatic integrates with Microsoft Entra ID for Kubernetes RBAC. Use group-based role bindings:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: aks-admins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: Group
apiGroup: rbac.authorization.k8s.io
name: "<entra-group-object-id>"
AKS Automatic uses a system-assigned managed identity for the control plane. Do not modify its role assignments.
Use Azure Key Vault Provider for Secrets Store CSI Driver (pre-installed) to mount secrets from Azure Key Vault as Kubernetes volumes. Never store Azure credentials in Kubernetes secrets.
ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.
Writing idiomatic, safe, and reviewable Bicep templates for Azure resources.
Non-blocking cluster status peek — run at the end of Phases 3, 4, 5 to check AKS provisioning progress without hanging.
Voice, tone, and interaction patterns for Kickstart agents.
Configure Infrastructure phase playbook — launch the dedicated Kickstart cluster-setup view, which collects and creates the Azure resources (subscription, resource group, AKS Automatic cluster, ACR) and hands the results back to the chat.
Deploy phase playbook — build, push, apply with Azure CLI and kubectl.